a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

Analysis

max time kernel
41s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
Size

16KB
MD5

7d2c9dcea4b12ddb26d943aef5956fc7
SHA1

6811f78b05d0b1d050bc211f48c06ba349b74ed5
SHA256

a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d
SHA512

f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c
SSDEEP

384:IZ76Fph0u+c1POTB7wqc1E3egvonG5LChm04LGrLmZ:VP+cgB2EvsG8mJ2Lu

Score

8^/10

adware stealer

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
1476	siwdaapi.exe
568	siwdaapi.exe
944	siwdaapi.exe
1768	siwdaapi.exe
1432	Process not Found
1716	siwdaapi.exe
108	siwdaapi.exe

Loads dropped DLL 14 IoCs

pid	Process
1996	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
1996	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
1476	siwdaapi.exe
1476	siwdaapi.exe
568	siwdaapi.exe
568	siwdaapi.exe
944	siwdaapi.exe
944	siwdaapi.exe
1768	siwdaapi.exe
1768	siwdaapi.exe
1432	Process not Found
1432	Process not Found
1716	siwdaapi.exe
1716	siwdaapi.exe

Installs/modifies Browser Helper Object 2 TTPs 16 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45694105-5108-9405-3695-954187462154}	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45694105-5108-9405-3695-954187462154}	siwdaapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{45694105-5108-9405-3695-954187462154}\ = "mpwddapi.dll"	siwdaapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{45694105-5108-9405-3695-954187462154}\ = "mpwddapi.dll"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{45694105-5108-9405-3695-954187462154}\ = "mpwddapi.dll"	siwdaapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45694105-5108-9405-3695-954187462154}	siwdaapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{45694105-5108-9405-3695-954187462154}\ = "mpwddapi.dll"	siwdaapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{45694105-5108-9405-3695-954187462154}\ = "mpwddapi.dll"	siwdaapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45694105-5108-9405-3695-954187462154}	siwdaapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45694105-5108-9405-3695-954187462154}	siwdaapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45694105-5108-9405-3695-954187462154}	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{45694105-5108-9405-3695-954187462154}\ = "mpwddapi.dll"	siwdaapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45694105-5108-9405-3695-954187462154}	siwdaapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{45694105-5108-9405-3695-954187462154}\ = "mpwddapi.dll"	siwdaapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{45694105-5108-9405-3695-954187462154}\ = "mpwddapi.dll"	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45694105-5108-9405-3695-954187462154}	siwdaapi.exe

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\siwdaapi.exe	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\mpwddapi.dll	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\mpwddapi.dll	siwdaapi.exe
File created	C:\Windows\SysWOW64\mpwddapi.dll	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\siwdaapi.exe	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\spwdbapi.sys	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
File opened for modification	C:\Windows\SysWOW64\spwdbapi.sys	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\mpwddapi.dll	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\siwdaapi.exe	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
File opened for modification	C:\Windows\SysWOW64\spwdbapi.sys	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\siwdaapi.exe	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\siwdaapi.exe	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\mpwddapi.dll	siwdaapi.exe
File created	C:\Windows\SysWOW64\mpwddapi.dll	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\spwdbapi.sys	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\siwdaapi.exe	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	siwdaapi.exe
File created	C:\Windows\SysWOW64\mpwddapi.dll	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\mpwddapi.dll	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\spwdbapi.sys	Process not Found
File opened for modification	C:\Windows\SysWOW64\spwdbapi.sys	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
File created	C:\Windows\SysWOW64\siwdaapi.exe	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
File opened for modification	C:\Windows\SysWOW64\spwdbapi.sys	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\spwdbapi.sys	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\mpwddapi.dll	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\mpwddapi.dll	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\mpwddapi.dll	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
File created	C:\Windows\SysWOW64\mpwddapi.dll	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
File opened for modification	C:\Windows\SysWOW64\siwdaapi.exe	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	siwdaapi.exe
File opened for modification	C:\Windows\SysWOW64\siwdaapi.exe	Process not Found

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32\ = "C:\\Windows\\SysWow64\\mpwddapi.dll"	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32\ = "C:\\Windows\\SysWow64\\mpwddapi.dll"	siwdaapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32	siwdaapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32\ThreadingModel = "Apartment"	siwdaapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32\ThreadingModel = "Apartment"	siwdaapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32	siwdaapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32	siwdaapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32\ThreadingModel = "Apartment"	siwdaapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32\ThreadingModel = "Apartment"	siwdaapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32\ = "C:\\Windows\\SysWow64\\mpwddapi.dll"	siwdaapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32\ = "C:\\Windows\\SysWow64\\mpwddapi.dll"	siwdaapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32\ThreadingModel = "Apartment"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32\ThreadingModel = "Apartment"	siwdaapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32	siwdaapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32\ThreadingModel = "Apartment"	siwdaapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32	siwdaapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32	siwdaapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32\ = "C:\\Windows\\SysWow64\\mpwddapi.dll"	siwdaapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32\ThreadingModel = "Apartment"	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32\ = "C:\\Windows\\SysWow64\\mpwddapi.dll"	siwdaapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32\ = "C:\\Windows\\SysWow64\\mpwddapi.dll"	siwdaapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45694105-5108-9405-3695-954187462154}\InprocServer32\ = "C:\\Windows\\SysWow64\\mpwddapi.dll"	Process not Found

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1996	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
1476	siwdaapi.exe
568	siwdaapi.exe
944	siwdaapi.exe
1768	siwdaapi.exe
1432	Process not Found
1716	siwdaapi.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
Token: SeDebugPrivilege	1476	siwdaapi.exe
Token: SeDebugPrivilege	568	siwdaapi.exe
Token: SeDebugPrivilege	944	siwdaapi.exe
Token: SeDebugPrivilege	1768	siwdaapi.exe
Token: SeDebugPrivilege	1432	Process not Found
Token: SeDebugPrivilege	1716	siwdaapi.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1508	1996	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe	28
PID 1996 wrote to memory of 1508	1996	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe	28
PID 1996 wrote to memory of 1508	1996	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe	28
PID 1996 wrote to memory of 1508	1996	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe	28
PID 1996 wrote to memory of 1476	1996	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe	30
PID 1996 wrote to memory of 1476	1996	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe	30
PID 1996 wrote to memory of 1476	1996	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe	30
PID 1996 wrote to memory of 1476	1996	a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe	30
PID 1476 wrote to memory of 1456	1476	siwdaapi.exe	31
PID 1476 wrote to memory of 1456	1476	siwdaapi.exe	31
PID 1476 wrote to memory of 1456	1476	siwdaapi.exe	31
PID 1476 wrote to memory of 1456	1476	siwdaapi.exe	31
PID 1476 wrote to memory of 568	1476	siwdaapi.exe	33
PID 1476 wrote to memory of 568	1476	siwdaapi.exe	33
PID 1476 wrote to memory of 568	1476	siwdaapi.exe	33
PID 1476 wrote to memory of 568	1476	siwdaapi.exe	33
PID 568 wrote to memory of 680	568	siwdaapi.exe	34
PID 568 wrote to memory of 680	568	siwdaapi.exe	34
PID 568 wrote to memory of 680	568	siwdaapi.exe	34
PID 568 wrote to memory of 680	568	siwdaapi.exe	34
PID 568 wrote to memory of 944	568	siwdaapi.exe	36
PID 568 wrote to memory of 944	568	siwdaapi.exe	36
PID 568 wrote to memory of 944	568	siwdaapi.exe	36
PID 568 wrote to memory of 944	568	siwdaapi.exe	36
PID 944 wrote to memory of 1516	944	siwdaapi.exe	39
PID 944 wrote to memory of 1516	944	siwdaapi.exe	39
PID 944 wrote to memory of 1516	944	siwdaapi.exe	39
PID 944 wrote to memory of 1516	944	siwdaapi.exe	39
PID 944 wrote to memory of 1768	944	siwdaapi.exe	37
PID 944 wrote to memory of 1768	944	siwdaapi.exe	37
PID 944 wrote to memory of 1768	944	siwdaapi.exe	37
PID 944 wrote to memory of 1768	944	siwdaapi.exe	37
PID 1768 wrote to memory of 1292	1768	siwdaapi.exe	40
PID 1768 wrote to memory of 1292	1768	siwdaapi.exe	40
PID 1768 wrote to memory of 1292	1768	siwdaapi.exe	40
PID 1768 wrote to memory of 1292	1768	siwdaapi.exe	40
PID 1768 wrote to memory of 1432	1768	siwdaapi.exe	42
PID 1768 wrote to memory of 1432	1768	siwdaapi.exe	42
PID 1768 wrote to memory of 1432	1768	siwdaapi.exe	42
PID 1768 wrote to memory of 1432	1768	siwdaapi.exe	42
PID 1432 wrote to memory of 1112	1432	Process not Found	43
PID 1432 wrote to memory of 1112	1432	Process not Found	43
PID 1432 wrote to memory of 1112	1432	Process not Found	43
PID 1432 wrote to memory of 1112	1432	Process not Found	43
PID 1432 wrote to memory of 1716	1432	Process not Found	47
PID 1432 wrote to memory of 1716	1432	Process not Found	47
PID 1432 wrote to memory of 1716	1432	Process not Found	47
PID 1432 wrote to memory of 1716	1432	Process not Found	47
PID 1716 wrote to memory of 892	1716	siwdaapi.exe	45
PID 1716 wrote to memory of 892	1716	siwdaapi.exe	45
PID 1716 wrote to memory of 892	1716	siwdaapi.exe	45
PID 1716 wrote to memory of 892	1716	siwdaapi.exe	45
PID 1716 wrote to memory of 108	1716	siwdaapi.exe	48
PID 1716 wrote to memory of 108	1716	siwdaapi.exe	48
PID 1716 wrote to memory of 108	1716	siwdaapi.exe	48
PID 1716 wrote to memory of 108	1716	siwdaapi.exe	48
PID 108 wrote to memory of 1068	108	siwdaapi.exe	49
PID 108 wrote to memory of 1068	108	siwdaapi.exe	49
PID 108 wrote to memory of 1068	108	siwdaapi.exe	49
PID 108 wrote to memory of 1068	108	siwdaapi.exe	49

C:\Users\Admin\AppData\Local\Temp\a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
"C:\Users\Admin\AppData\Local\Temp\a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7120150.bat
  2⤵
  PID:1508
- C:\Windows\SysWOW64\siwdaapi.exe
  C:\Windows\system32\siwdaapi.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7120431.bat
    3⤵
    PID:1456
- - C:\Windows\SysWOW64\siwdaapi.exe
    C:\Windows\system32\siwdaapi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:568
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7120494.bat
      4⤵
      PID:680
  - - C:\Windows\SysWOW64\siwdaapi.exe
      C:\Windows\system32\siwdaapi.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      Drops file in System32 directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:944
    - - C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1768
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7122132.bat
        6⤵
        
        PID:1292
      - C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        6⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7122646.bat
        7⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        8⤵
        Executes dropped EXE
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:108
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7123582.bat
        9⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        9⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7124238.bat
        10⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        10⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7125876.bat
        11⤵
        
        PID:764
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        11⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7126749.bat
        12⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        12⤵
        
        PID:628
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        13⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7128106.bat
        14⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        14⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        15⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7138168.bat
        16⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        16⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        17⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7143192.bat
        18⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        18⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7176170.bat
        19⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        19⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7176373.bat
        20⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        20⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7177746.bat
        21⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        21⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7221551.bat
        22⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        22⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7222877.bat
        23⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        23⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7223439.bat
        24⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        24⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7224047.bat
        25⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        25⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7224453.bat
        26⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        26⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7225669.bat
        27⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        27⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7226933.bat
        28⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        28⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7227214.bat
        29⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        29⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7227838.bat
        30⤵
        
        PID:268
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        30⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7228524.bat
        31⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        31⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7248071.bat
        32⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        32⤵
        
        PID:472
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7248602.bat
        33⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        33⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7254966.bat
        34⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        34⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7255512.bat
        35⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        35⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7255965.bat
        36⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        36⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7258383.bat
        37⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\siwdaapi.exe
        
        C:\Windows\system32\siwdaapi.exe
        37⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7258508.bat
        27⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7257915.bat
        26⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7256199.bat
        25⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7255575.bat
        24⤵
        
        PID:980
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7254795.bat
        23⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7254670.bat
        22⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7254608.bat
        21⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7209367.bat
        20⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7208057.bat
        19⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7207807.bat
        18⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7141600.bat
        17⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7174953.bat
        17⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7172473.bat
        16⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7128808.bat
        15⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7168261.bat
        15⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7160305.bat
        14⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7127451.bat
        13⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7159853.bat
        13⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7158495.bat
        12⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7158152.bat
        11⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7156155.bat
        10⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7155329.bat
        9⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7155063.bat
        8⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7154174.bat
        7⤵
        
        PID:2088
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7154003.bat
        6⤵
        
        PID:556
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7121617.bat
        5⤵
        
        PID:1516
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7153831.bat
        5⤵
        
        PID:1476
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7152427.bat
      4⤵
      PID:1900
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7151881.bat
    3⤵
    PID:1588
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7153035.bat
  2⤵
  PID:1796

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\~DFD7123161.bat
1⤵
PID:892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~DFD7120150.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7120431.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7120494.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7121617.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7122132.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7122646.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7123161.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7123582.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7124238.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7125876.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD7126749.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Windows\SysWOW64\mpwddapi.dll

Filesize
524KB

MD5
42b9b66b5da5387c78f2ab6783662b06

SHA1
8608c134d5cd20414ab332a7e4833ef55533ca29

SHA256
3afabaa0a89045e4b06097cd89bb74a7b24a0746368d7cb0e199abaf824af2e4

SHA512
297b52bf56f939815450620354924e4df47d980a193ec936263354a99872d2b0ce6040daa45565cf233a1d290d8465cd7d9252b37338d60a3fbb044de65504b1

Download Submit
C:\Windows\SysWOW64\mpwddapi.dll

Filesize
524KB

MD5
42b9b66b5da5387c78f2ab6783662b06

SHA1
8608c134d5cd20414ab332a7e4833ef55533ca29

SHA256
3afabaa0a89045e4b06097cd89bb74a7b24a0746368d7cb0e199abaf824af2e4

SHA512
297b52bf56f939815450620354924e4df47d980a193ec936263354a99872d2b0ce6040daa45565cf233a1d290d8465cd7d9252b37338d60a3fbb044de65504b1

Download Submit
C:\Windows\SysWOW64\mpwddapi.dll

Filesize
524KB

MD5
42b9b66b5da5387c78f2ab6783662b06

SHA1
8608c134d5cd20414ab332a7e4833ef55533ca29

SHA256
3afabaa0a89045e4b06097cd89bb74a7b24a0746368d7cb0e199abaf824af2e4

SHA512
297b52bf56f939815450620354924e4df47d980a193ec936263354a99872d2b0ce6040daa45565cf233a1d290d8465cd7d9252b37338d60a3fbb044de65504b1

Download Submit
C:\Windows\SysWOW64\mpwddapi.dll

Filesize
524KB

MD5
42b9b66b5da5387c78f2ab6783662b06

SHA1
8608c134d5cd20414ab332a7e4833ef55533ca29

SHA256
3afabaa0a89045e4b06097cd89bb74a7b24a0746368d7cb0e199abaf824af2e4

SHA512
297b52bf56f939815450620354924e4df47d980a193ec936263354a99872d2b0ce6040daa45565cf233a1d290d8465cd7d9252b37338d60a3fbb044de65504b1

Download Submit
C:\Windows\SysWOW64\mpwddapi.dll

Filesize
524KB

MD5
42b9b66b5da5387c78f2ab6783662b06

SHA1
8608c134d5cd20414ab332a7e4833ef55533ca29

SHA256
3afabaa0a89045e4b06097cd89bb74a7b24a0746368d7cb0e199abaf824af2e4

SHA512
297b52bf56f939815450620354924e4df47d980a193ec936263354a99872d2b0ce6040daa45565cf233a1d290d8465cd7d9252b37338d60a3fbb044de65504b1

Download Submit
C:\Windows\SysWOW64\mpwddapi.dll

Filesize
524KB

MD5
42b9b66b5da5387c78f2ab6783662b06

SHA1
8608c134d5cd20414ab332a7e4833ef55533ca29

SHA256
3afabaa0a89045e4b06097cd89bb74a7b24a0746368d7cb0e199abaf824af2e4

SHA512
297b52bf56f939815450620354924e4df47d980a193ec936263354a99872d2b0ce6040daa45565cf233a1d290d8465cd7d9252b37338d60a3fbb044de65504b1

Download Submit
C:\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
C:\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
C:\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
C:\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
C:\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
C:\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
C:\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
C:\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
C:\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
C:\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
C:\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
C:\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
C:\Windows\SysWOW64\spwdbapi.sys

Filesize
3KB

MD5
da9cb664faecfc1668dbcaca63c68ddf

SHA1
ffe431f04b18dcb9adfa26e6787ce5700e331139

SHA256
146a3b8131a7732abb28bc7c1d82980adcaba8e37ee2e586fa821a55b9c1208e

SHA512
690064de69005d110d88bb6f7523dbade932cc23a00752ceb276a27615c024c944b66f7c42325c2ed7486a7a2ab08a1a4aa56a44262bc05ea0769f33139dc6c0

Download Submit
C:\Windows\SysWOW64\spwdbapi.sys

Filesize
4KB

MD5
6a0f79c73f86eb918df0cacb4b29ed8c

SHA1
ce3a4b47067cd23937eae8d8b3cade462be52365

SHA256
0b761b9f79dc5b048041c5c931c0410dd59a5502d40f1240f1f22a37ce5c8b8f

SHA512
b89acdfcd7a9925dcac4e4798a67d314fd91eaa7fb4b60fc067136cb8b4a319ac7ead80ef2a285cf74e020a320e9563d4e83bcce23aa9aaa13c5e59f6e83719d

Download Submit
C:\Windows\SysWOW64\spwdbapi.sys

Filesize
4KB

MD5
f7c9ed8922e4a54a0992634198ebc702

SHA1
69d02272cd6b089e8d5c1765d43fb16f115cfcb0

SHA256
07e0ac2ddce10266e8c0d22fe5533ee382d5bfcd86a8646bba80e5a9ba36a7dd

SHA512
b869829e02fb6fe92239888e6d07b97f8baa470034a7cef075718055c49cb218fd64b64c935e9f259fe2df178bb5d0bf21945f3e5d1e571a14b81738f3a2ec41

Download Submit
C:\Windows\SysWOW64\spwdbapi.sys

Filesize
5KB

MD5
3023f507945fe61a4dca62f9ba6ef9f6

SHA1
19223992e6273374059c4666c0d40e3150f6b684

SHA256
d9db83ac862f8fc20c171450ba9e9d48d756f93cdd6ce10f1bdda4126c030c94

SHA512
542233edc28b5d070600ea80de44341b4af8469988181843d082249cae0c7c61eedfa06e0d57b1739756c278f1f7df388c36811737453cf45b64d067df70b954

Download Submit
C:\Windows\SysWOW64\spwdbapi.sys

Filesize
5KB

MD5
8cdbf1435ad404ff6d8ae083e46e772a

SHA1
3d4ea215188ce79d32eb08f7570a58a94eca2444

SHA256
0ff637af4fe905b680d72ff97dcfe40f19004d2894980ed10d21117d80389bc6

SHA512
0af6b01479f513b2bb8a6b61931ec66ff7bae34aa0d4d0bb749abf72dc2c48f18a14704dcb9198850b5d34cc2e0cd2dfe2f631d95141a14bb8a8df00825fb478

Download Submit
C:\Windows\SysWOW64\spwdbapi.sys

Filesize
6KB

MD5
db0fe6bd592a5247e78021bebdadb2e3

SHA1
52a6eb2559a1e05fe57b6e7cac38e3e97286146d

SHA256
b95eead8acef840027cbfad080d1fa9cd8ead52112d8f54dd7d3bad9516790a3

SHA512
66335472d38988c9461aa9a7f4ceba38cd7f0b5d6d6234696ba1fe8b3a2a86c1c91cf6ecefa0c35c0ec07ad66e6a9a427b15363f76319d3d60a94f45680cee30

Download Submit
C:\Windows\SysWOW64\spwdbapi.sys

Filesize
1KB

MD5
2601e869da9cc7f2b29880b840bbe68f

SHA1
ca6bc38b612d2f2a6b56ac99d9a37f92c59c0ab7

SHA256
1c22b8f720ec2ccbbd6ad6ceb933d63b8e711bac7d3d2a72b010bd550ab59b75

SHA512
4880b8918cd009ba98384290efd69f928cfdd9d2445ba634515551f98e5f10ccde988bfe8dfe99fd4ba9e61ce6d43ba35b7f04b33727bb8f9e4d9a8bb79c4aac

Download Submit
C:\Windows\SysWOW64\spwdbapi.sys

Filesize
1KB

MD5
0ee37e9a8ba7430e8cd0c9fa4eb1fa3d

SHA1
f56a84637537fe6b8ace530f69a987f6d13b88e2

SHA256
ed90ad22e4e483ab927d62cefb15f16a0e7c737ba45334fbd244893f5332e937

SHA512
1f55e4d1795863a10d6882a0ab13278714a6351059d36a31f359353a0ddb3904dfd8b0dbd9dc7a6f5210e7eb7c1c0df71b8f6be0f2dc7b32ba71fb02b2994a5e

Download Submit
C:\Windows\SysWOW64\spwdbapi.sys

Filesize
2KB

MD5
1628ae783af22af6f5a8428e951a6085

SHA1
f243a36de523a99f9ee131f3ee4ae91dbd2ef5a2

SHA256
d091fa425fc9768188e5d157bcfc06b9eff43a57f911dfc2c3819b9fb36844d6

SHA512
836859ec08978f9cf7a3b8db10f79472ed324d4f02f2700c0cac0585e4f0d642aa36a39952307f2ec9bfba08ba3cbce4636ea2b23065c84508d189a22fe9fe52

Download Submit
C:\Windows\SysWOW64\spwdbapi.sys

Filesize
2KB

MD5
c37eff37f50d848e916b636d48def190

SHA1
f451f14142ef050f4eb4bd2c03b9959d3da80cca

SHA256
2d4ad8a35e3345235f05bf149735dc3fbe0abb2248505c94f5dd0e09ce5c45b5

SHA512
24eaac31656dea9cd9c26f9051f12c42464512810ee7312d3f5ec46c63a0479200772b2f375a753851879599aef905143f9783855e8d6ff96a676e2a534056e9

Download Submit
C:\Windows\SysWOW64\spwdbapi.sys

Filesize
3KB

MD5
c184c15ccbc0082d3d2bedf7d7f746f8

SHA1
4488a10f22d69d73742e3911534df4038f5ee44b

SHA256
705ea38d886b7cd01ce48f35357bfcfed07e0fc0319167d71f78066da581ed12

SHA512
63ddff1c4c1a7d3e0a8a700f947b353eb8694449e6ca0d6395f631e8807e4fa0aa9660cd6b0277af2bb34a595b24de3af20b7809098d4e3b2d4e0406669ebb46

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
\Windows\SysWOW64\siwdaapi.exe

Filesize
16KB

MD5
7d2c9dcea4b12ddb26d943aef5956fc7

SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5

SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d

SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c

Download Submit
memory/472-243-0x00000000001B0000-0x00000000001CA000-memory.dmp

Filesize
104KB

Download
memory/472-242-0x00000000001B0000-0x00000000001CA000-memory.dmp

Filesize
104KB

Download
memory/628-159-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/1104-142-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/1104-144-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/1168-147-0x00000000005B0000-0x00000000005CA000-memory.dmp

Filesize
104KB

Download
memory/1168-158-0x00000000005B0000-0x00000000005CA000-memory.dmp

Filesize
104KB

Download
memory/1304-160-0x0000000000220000-0x000000000023A000-memory.dmp

Filesize
104KB

Download
memory/1476-84-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1576-190-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/1576-184-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/1576-191-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/1576-185-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/1820-240-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/1820-241-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/1904-153-0x00000000005B0000-0x00000000005CA000-memory.dmp

Filesize
104KB

Download
memory/1904-167-0x00000000005B0000-0x00000000005CA000-memory.dmp

Filesize
104KB

Download
memory/1904-152-0x00000000005B0000-0x00000000005CA000-memory.dmp

Filesize
104KB

Download
memory/1904-168-0x00000000005B0000-0x00000000005CA000-memory.dmp

Filesize
104KB

Download
memory/1996-75-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1996-80-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2076-239-0x0000000000280000-0x000000000029A000-memory.dmp

Filesize
104KB

Download
memory/2076-238-0x0000000000280000-0x000000000029A000-memory.dmp

Filesize
104KB

Download
memory/2124-222-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2124-237-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2412-187-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2412-186-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2412-192-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2412-193-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2456-194-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2456-195-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2456-189-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2516-202-0x0000000000270000-0x000000000028A000-memory.dmp

Filesize
104KB

Download
memory/2516-203-0x0000000000270000-0x000000000028A000-memory.dmp

Filesize
104KB

Download
memory/2516-224-0x0000000000270000-0x000000000028A000-memory.dmp

Filesize
104KB

Download
memory/2516-223-0x0000000000270000-0x000000000028A000-memory.dmp

Filesize
104KB

Download
memory/2684-209-0x00000000001B0000-0x00000000001CA000-memory.dmp

Filesize
104KB

Download
memory/2684-226-0x00000000001B0000-0x00000000001CA000-memory.dmp

Filesize
104KB

Download
memory/2684-225-0x00000000001B0000-0x00000000001CA000-memory.dmp

Filesize
104KB

Download
memory/2684-208-0x00000000001B0000-0x00000000001CA000-memory.dmp

Filesize
104KB

Download
memory/2792-227-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2792-210-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2792-211-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2836-228-0x0000000000420000-0x000000000043A000-memory.dmp

Filesize
104KB

Download
memory/2836-212-0x0000000000420000-0x000000000043A000-memory.dmp

Filesize
104KB

Download
memory/2836-213-0x0000000000420000-0x000000000043A000-memory.dmp

Filesize
104KB

Download
memory/2836-229-0x0000000000420000-0x000000000043A000-memory.dmp

Filesize
104KB

Download
memory/2896-230-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2896-231-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2896-214-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2896-215-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2916-244-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2916-245-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2932-216-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2932-233-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2932-232-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2932-217-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2972-234-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2972-218-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/3020-235-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/3020-219-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/3020-220-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/3056-236-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/3056-221-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download